SFTP File transfer above threshold

let threshold = 50;
Syslog
| where ProcessName has "sftp"
    and SyslogMessage has "close "
    and SyslogMessage has " bytes read "
| parse SyslogMessage with "close \"" filepath "\" bytes read " readbytes: int " written " writtenbytes: int
| join kind=leftouter (
    Syslog
    | where ProcessName has "sftp" and SyslogMessage has "session opened for"
    | parse SyslogMessage with "session opened for local user " username: string " from [" src_ip "]"
    | project username, src_ip, ProcessID
    )
    on ProcessID
| project-away ProcessID1
| summarize count_distinct_filepath=dcount(filepath), fileslist=make_set(filepath) by Computer, username, src_ip, bin(TimeGenerated, 15m)
| where count_distinct_filepath >= threshold
| extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField","_", tostring(hash(tostring(fileslist)))))

alertDetailsOverride: 
description: |
  'Identifies SFTP File Transfers above certain threshold in a 15min time period. It requires SFTP VERBOSE loglevel to be enabled.
   Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.'  
kind: Scheduled
tactics:
- Exfiltration
requiredDataConnectors:
- connectorId: Syslog
  dataTypes:
  - Syslog
- connectorId: SyslogAma
  dataTypes:
  - Syslog
incidentConfiguration:
  groupingConfiguration:
    enabled: true
    groupByEntities:
    - Account
    - Host
    reopenClosedIncident: false
    lookbackDuration: 5h
    matchingMethod: Selected
    groupByCustomDetails: []
    groupByAlertDetails: []
  createIncident: true
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Syslog/Analytic Rules/sftp_file_transfer_above_threshold.yaml
severity: Medium
name: SFTP File transfer above threshold
customDetails:
  FilesList: fileslist
  TransferCount: count_distinct_filepath
triggerThreshold: 0
queryPeriod: 15m
query: |
  let threshold = 50;
  Syslog
  | where ProcessName has "sftp"
      and SyslogMessage has "close "
      and SyslogMessage has " bytes read "
  | parse SyslogMessage with "close \"" filepath "\" bytes read " readbytes: int " written " writtenbytes: int
  | join kind=leftouter (
      Syslog
      | where ProcessName has "sftp" and SyslogMessage has "session opened for"
      | parse SyslogMessage with "session opened for local user " username: string " from [" src_ip "]"
      | project username, src_ip, ProcessID
      )
      on ProcessID
  | project-away ProcessID1
  | summarize count_distinct_filepath=dcount(filepath), fileslist=make_set(filepath) by Computer, username, src_ip, bin(TimeGenerated, 15m)
  | where count_distinct_filepath >= threshold
  | extend FileSample = iff(array_length(fileslist) == 1, tostring(fileslist[0]), strcat("SeeFilesListField","_", tostring(hash(tostring(fileslist)))))  
relevantTechniques:
- T1020
id: bb6a74c8-889d-4c6e-8412-7d5efe33f4ed
queryFrequency: 15m
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: username
    identifier: Name
- entityType: IP
  fieldMappings:
  - columnName: src_ip
    identifier: Address
- entityType: Host
  fieldMappings:
  - columnName: Computer
    identifier: HostName
- entityType: File
  fieldMappings:
  - columnName: FileSample
    identifier: Name
triggerOperator: gt
version: 1.0.2